# Get alerting from \_stats
**URL:** https://discuss.elastic.co/t/get-alerting-from-stats/180542
**Category:** Elasticsearch
**Tags:** elastic-stack-alerting
**Created:** [May 10, 2019, 11:11am UTC](https://discuss.elastic.co/t/get-alerting-from-stats/180542 "2019-05-10T11:11:45Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@simple\_commentateur](https://discuss.elastic.co/u/simple_commentateur)
#### Post date: [May 10, 2019, 11:11am UTC](https://discuss.elastic.co/t/get-alerting-from-stats/180542/1 "2019-05-10T11:11:45Z")
Hello,
I want to get alerts if the size of data stored exceeds a certain threshold :
...
"total" : {
"store" : {
"size\_in\_bytes" : 984869969
}
}
...
I don't know how to get \_stats hit in watcher and get "size\_in\_bytes" value. I try this but nothing happen:
{
"trigger": {
"schedule": {
"interval": "50s"
}
},
"input": {
"search": {
"request": {
"search\_type": "query\_then\_fetch",
"indices": [
"\_stats"
],
"rest\_total\_hits\_as\_int": true
}
}
},
"condition": {
"compare": {
"ctx.payload.hits.total": {
"gte": 1
}
}
},
"actions": {
"send\_email": {
"email": {
"profile": "standard",
"to": [
"test@gmail.com"
],
"subject": "Tests",
"body": {
"html": "
it work
"
}
}
}
}
}
Can someone help me to get this alert?
---
### Author:  [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [May 10, 2019, 11:29am UTC](https://discuss.elastic.co/t/get-alerting-from-stats/180542/2 "2019-05-10T11:29:21Z")
The stats endpoint is not an index and thus cannot be searched. It is a HTTP endpoint, that can be polled using the [http input](https://www.elastic.co/guide/en/elastic-stack-overview/7.0/input-http.html)
---
### Author:  [@simple\_commentateur](https://discuss.elastic.co/u/simple_commentateur)
#### Post date: [May 10, 2019, 1:05pm UTC](https://discuss.elastic.co/t/get-alerting-from-stats/180542/3 "2019-05-10T13:05:21Z")
Thanks,
I'm sure it's the solution but it still don't work, maybe i can't connect to my Elastic cloud cluster:
{
"trigger": {
"schedule": {
"interval": "10s"
}
},
"input": {
"http": {
"request": {
"scheme": "https",
"host": "[abcdefghijklmnopqrstuvwxyz123456.europe-west1.gcp.cloud.es.io](http://abcdefghijklmnopqrstuvwxyz123456.europe-west1.gcp.cloud.es.io)",
"port": 9243,
"method": "get",
"path": "/\_cluster/stats",
"params": {},
"headers": {},
"auth": {
"basic": {
"username": "elastic",
"password": "::es\_redacted::"
}
}
}
}
},
"condition": {
"compare": {
"ctx.payload.hits.total": {
"gte": 0
}
}
},
"actions": {
"send\_email": {
"email": {
"profile": "standard",
"to": [
"test@gmail.com"
],
"subject": "Tests",
"body": {
"html": "
it work
"
}
}
}
}
}
---
### Author:  [@simple\_commentateur](https://discuss.elastic.co/u/simple_commentateur)
#### Post date: [May 10, 2019, 2:13pm UTC](https://discuss.elastic.co/t/get-alerting-from-stats/180542/4 "2019-05-10T14:13:36Z")
I find the problem. it was the condition that don't match. i use ctx.payload.indices.store.size\_in\_bytes and it work
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 7, 2019, 2:13pm UTC](https://discuss.elastic.co/t/get-alerting-from-stats/180542/5 "2019-06-07T14:13:38Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.